Got asked by a director level security person today, whether disabling their site from displaying the HTML source was a good solution to XSS SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique